Wednesday 22 September 2010

Padding oracle attack on ASP.net a.k.a POET vs. ASP.net

I've been spending a bit of time at work looking at this...and a load more at home last night. It turns out once you get past all the jargon and attempts at security through obscurity it's fairly simple. First off - watch the following video - but keep in mind these things:
  1. This has nothing to do with any sort of Oracle database - the oracle in this case is referring to something that you are able to use to extract useful information from a server. 
  2. This is not restricted to DotNetNuke - it applies to pretty much all ASP.net applications.
  3. Don't get distracted by the bit after the DotNetNuke session token has been created because at this point it's game over and the rest is just a show.
  4. Don't get distracted by them setting custom errors to false - that setting is important but simply setting it to remoteOnly or whatever which is normal good practice is not enough to protect you!
  5. Don't blame me for "helping the bad guys" - all that damage has already been done as the exploit tool is out there. What's important now is that the good guys understand the risk and mitigations.

Friday 17 September 2010

Cycling: Folding bike for commuting - Raleigh Folda review and user guide

I wanted to get myself a folding bike for commuting having tried the Barclays cycle hire and been impressed with the ease of cycling and provision of cycling paths but put off by the lack of bikes and bike rack space in the mornings. I figured a folding bike could be used both ends of my journey and also it would be door-to-door unlike the cycle scheme. Some are crazy expensive and I wasn’t sure how much use I would get from it so I decided to take a bit of a gamble on a cheapy one from Amazon. It was made more of a gamble than it should have been due to a complete lack of pictures, reviews, or anything much at all on the internet about this bike. Well, now I’ve taken the plunge I can help you buy armed with much more detailed knowledge! If you find this information useful then please use the link on the right to go back to Amazon to buy as I’ll get a small amount of commission for my trouble at no cost to you!